janhoy opened a new pull request, #865: URL: https://github.com/apache/solr-operator/pull/865
Routine dependency sweep, and it turns out to be a security one: the Kubernetes client libraries move to 1.37, controller-runtime to 0.25 and Helm to 3.22, which pulls `golang.org/x/net` to 0.61.0 and `golang.org/x/text` to 0.43.0 and closes six vulnerabilities that govulncheck confirms were call-path reachable from the operator — five HTTP/2 denial-of-service issues and an infinite loop on invalid input. Sets and spans crossed: the Kubernetes set (`api`, `apimachinery`, `client-go` and the indirect `k8s.io/*` entries) v0.36.2 → v0.37.1; `controller-runtime` v0.24.1 → v0.25.2; `helm.sh/helm/v3` v3.21.2 → v3.22.1; `cert-manager` v1.20.2 → v1.21.3; the Ginkgo/Gomega/testify test stack; and the pinned tools — controller-gen v0.21.0 → v0.23.0, kind v0.30.0 → v0.33.0, yq v4.53.3 → v4.54.1, envtest assets 1.36.0 → 1.37.0. Not mechanical, worth a reviewer's eye: cert-manager 1.21 renamed `cmmeta.ObjectReference` to `IssuerReference` (same fields), which is three call sites in `tests/e2e/utils_tls_test.go` — cert-manager is imported only by the e2e tests, never by production code. The kustomize tool pin takes its major, v4.5.7 → v5.8.0, in a separate commit: the v4 line ended in 2022, only `kustomize edit add resource` and `edit set image` are used and both are unchanged in v5; I verified `make prepare-deploy-kustomize` and a full `kustomize build config/default` (v5.8.0 rather than v5.8.3 keeps the pinned Go 1.26 toolchain). `helm.sh/helm` v4 exists and is deliberately **not** in this PR — one test file, but it deserves its own review. The regenerated CRDs are ~1950 added lines and purely additive: the new optional pod fields that come with the Kubernetes 1.37 API types (gRPC probe `protocol`/`mode`, projected-volume `user`/`defaultUser`). Every removed line is upstream description rewording; no field, validation or default was dropped, and generated RBAC is unchanged. For the record, the Kubernetes support gap has widened — the charts declare `kubeVersion >= 1.22.0-0` while the libraries now build against 1.37 and the oldest version actually tested is 1.26.6. This PR deliberately does not touch `kubeVersion` or the compatibility matrix; raising the declared floor is a breaking change for existing users and should be its own PR timed to a release. Changelog: a `security` entry and a `changed` entry in `helm/solr-operator/Chart.yaml` (with `containsSecurityUpdates` flipped to `"true"`), and a `changed` entry in `helm/solr/Chart.yaml` for the widened CRD schema. Ran `make lint` and `make test`, both clean. Did not run `make e2e-tests` — note CI's e2e workflow is permanently disabled, so it is evidence of nothing; the cert-manager rename above is in e2e code, so that suite is worth a local run before merge. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
